Section 1. Short title
This Act may be cited as the Manage Your Data and Allow Only Trusted Access Act of 2025 or the MY DATA Act of 2025.
(1) In general
A covered entity may not prevent an individual from using de-identified data or cloaked data.
(2) Exception
The prohibition described in paragraph (1) does not apply to a covered entity to the extent that the covered entity acts as a service provider.
(1) Unfair or deceptive acts or practices
A violation of subsection (a)(1) shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
(2) Powers of the Commission
The Federal Trade Commission shall enforce subsection (a)(1) in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section, and any person who violates subsection (a)(1) shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.
(c) Definitions
In this section:
(1) Cloaked data
The term cloaked data means unique persistent identifiers that serve to adequately replace and conceal the covered data and identity of an individual while enabling communication between a covered entity and the individual.
(2) Covered data
The term covered data means information that identifies or is linked or reasonably linkable (alone or in combination with other information) to an individual (or a device that identifies or is linked or reasonably linkable to an individual).
(A) In general
The term covered entity means any person (other than an individual acting in a non-commercial context) who (alone or jointly with others) collects, processes, or transfers covered data.
(B) Exclusions
The term covered entity does not include any of the following:
(i) A Federal, State, or local government entity, such as a body, authority, board, bureau, commission, district, agency, or political subdivision of the Federal Government or a State or local government.
(ii) An entity that serves as a congressionally designated nonprofit, national resource center, and clearinghouse to provide assistance to victims, families, child-serving professionals, and the general public on issues relating to missing and exploited children.
(4) De-identified data
The term de-identified data means information that does not identify and is not linked or reasonably linkable to an individual (or a device that identifies or is linked or reasonably linkable to an individual), regardless of whether such information is aggregated.
(5) Unique persistent identifier
The term unique persistent identifier means an identifier—
(A) to the extent that such identifier is linked or reasonably linkable to an individual (or a device that identifies or is linked or reasonably linkable to an individual); and
(B) that is created uniquely for communication between such individual and a covered entity.